User's Manual

Table Of Contents
123
Users Manual of CS-6306R
6.2.1.2 RADIUS Operation
When a user attempts to log in and authenticate to an access server using RADIUS, the following steps
occur:
(1) The user is prompted for and enters a username and password.
(2) The username and encrypted password are sent over the network to theRADIUS server.
(3) The user receives one of the following responses from the RADIUS server:
a. ACCEPTthe user is authenticated.
b. REJECTthe user is not authenticated and is prompted to reenter the username and password, or
access is denied.
c. CHALLENGE—a challenge is issued by the RADIUS server. The challenge collects additional data
from the user.
d. CHANGE PASSWORD—a request is issued by the RADIUS server, asking the user to select a new
password.
The ACCEPT or REJECT response is bundled with additional data that is used for EXEC or network
authorization. You must first complete RADIUS authentication before using RADIUS authorization. The
additional data included with the ACCEPT or REJECT packets consists of the following:
Services that the user can access, including Telnet, rlogin, or local-area transport (LAT) connections, and PPP,
Serial Line Internet Protocol (SLIP), or EXEC services.
Connection parameters,include the host or client IP address, access list, and user timeouts.
6.2.2 RADIUS Configuration Task List
To configure RADIUS on your switch or access server, you must perform the following tasks:
Use the aaa authentication global configuration command to define method lists for RADIUS
authentication. For more information about using the aaa authentication command, refer to the
"Configuring Authentication" chapter.
Use line and interface commands to enable the defined method lists to be used. For more information,
refer to the "Configuring Authentication" chapter.
The following configuration tasks are optional:
You may use the aaa authorization global command to authorize specific user functions. For more
information about using the aaa authorization command, refer to the chapter "Configuring Authorization."
You may use the aaa accounting command to enable accounting for RADIUS connections. For more
information about using the aaa accounting command, refer to the chapter "Configuring Accounting."